evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[PATCH] USB: Gadget RNDIS fix alloc bug. (buffer overflow)

Browse source 
Remote NDIS response to OID_GEN_SUPPORTED_LIST only allocated space
for the data attached to the reply, and not the reply structure
itself. This caused other kmalloc'd memory to be corrupted.

Signed-off-by: Shaun Tancheff <shaun@tancheff.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Shaun Tancheff 2006-02-22 19:47:19 -08:00 • committed by Greg Kroah-Hartman
parent d5ec33490c
commit 8763716bfe
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
drivers/usb/gadget/rndis.c
View file

@ -855,9 +855,12 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
/* /*
* we need more memory: * we need more memory:
* oid_supported_list is the largest answer * gen_ndis_query_resp expects enough space for
* rndis_query_cmplt_type followed by data.
* oid_supported_list is the largest data reply
*/ */
r = rndis_add_response (configNr, sizeof (oid_supported_list)); r = rndis_add_response (configNr,
sizeof (oid_supported_list) + sizeof(rndis_query_cmplt_type));
if (!r) if (!r)
return -ENOMEM; return -ENOMEM;
resp = (rndis_query_cmplt_type *) r->buf; resp = (rndis_query_cmplt_type *) r->buf;